Main Grammar

Grammar Rules & Constraints

• Constraint Rule: Dependent Parameters

  The [PORT] parameter is dependent on the host address identifier. A port number cannot be declared without its preceding [IP] address delimiter.

  Invalid Syntax: FROM :80 TO :443
  Valid Syntax: FROM 10.0.0.1:80 TO 10.0.0.2:443

Examples

• Syntax:

  FROM [IP]:[PORT]@[MAC] TO [IP]:[PORT]@[MAC]

  Example: Copy

  FROM 10.0.0.1 TO 10.0.0.2

  Output: Copy

  src host 10.0.0.1 and dst host 10.0.0.2
• Syntax:

  FROM [IP]:[PORT]@[MAC] TO [IP]:[PORT]@[MAC]

  Example: Copy

  FROM 192.168.1.1:80 TO 172.16.0.5:443

  Output: Copy

  src host 192.168.1.1 and src port 80 and dst host 172.16.0.5 and dst port 443
• Syntax:

  FROM [IP]:[PORT]@[MAC] TO [IP]:[PORT]@[MAC]

  Example: Copy

  FROM 10.0.0.1:80@00:11:22:33:44:55 TO 10.0.0.2:443@66:77:88:99:AA:BB

  Output: Copy

  ether src 00:11:22:33:44:55 and src host 10.0.0.1 and src port 80 and ether dst 66:77:88:99:AA:BB and dst host 10.0.0.2 and dst port 443
• Syntax:

  FROM [IP]:[PORT]@[MAC] TO [IP]:[PORT]@[MAC] WHERE TCP.WINDOW_SIZE [OPERATOR] [VALUE]

  Example: Copy

  FROM 10.0.0.1 TO 10.0.0.2 WHERE TCP.WINDOW_SIZE > 1024

  Output: Copy

  src host 10.0.0.1 and dst host 10.0.0.2 and tcp[14:2] > 1024
• Syntax:

  FROM [IP]:[PORT]@[MAC] TO [IP]:[PORT]@[MAC] WHERE IP.TTL [OPERATOR] [VALUE]

  Example: Copy

  FROM 10.0.0.1 TO 10.0.0.2 WHERE IP.TTL = 10

  Output: Copy

  src host 10.0.0.1 and dst host 10.0.0.2 and ip[8] = 10